CVE-2005-2670

Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/15846	Patch Vendor Advisory
http://secunia.com/secunia_research/2005-24/advisory	Patch Vendor Advisory
http://securitytracker.com/id?1014740	Patch Vendor Advisory
http://www.globalhauri.com/html/download/down_unixpatch.html	Patch
http://www.securityfocus.com/bid/14606

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hauri:livecall::::::::
	cpe:2.3:a:hauri:virobot_advanced_server::::::::
	cpe:2.3:a:hauri:virobot_expert:4.0:::::::*
	cpe:2.3:a:hauri:virobot_linux_server:2.0:::::::*

History

No history.

Information

Published : 2005-08-23 04:00

Updated : 2023-12-10 10:28

NVD link : CVE-2005-2670

Mitre link : CVE-2005-2670

CVE.ORG link : CVE-2005-2670

JSON object : View

Products Affected

hauri

virobot_advanced_server
livecall
virobot_expert
virobot_linux_server

CWE

NVD-CWE-Other

{"id": "CVE-2005-2670", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-08-23T04:00:00.000", "references": [{"url": "http://secunia.com/advisories/15846", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/secunia_research/2005-24/advisory", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1014740", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.globalhauri.com/html/download/down_unixpatch.html", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/14606", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via \"..\" sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files."}], "lastModified": "2008-09-05T20:52:23.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hauri:livecall:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E56296DA-A1F6-44A6-9394-FCD32ABC16C1"}, {"criteria": "cpe:2.3:a:hauri:virobot_advanced_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74A95949-84D0-461D-B864-434AA68DA501"}, {"criteria": "cpe:2.3:a:hauri:virobot_expert:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40BE675C-5081-406A-8802-333326E8F78C"}, {"criteria": "cpe:2.3:a:hauri:virobot_linux_server:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCDAD7E7-135D-4EE2-8C5F-641D6647F749"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}